CVE-2015-0273: Undefined Security Weakness

Multiple use-after-free vulnerabilities in ext/date/phpdate.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a 1 R or 2 r type specifier in a DateTimeZone data handled by the...

Internet Bug Bounty: Buffer Over-read in unserialize when parsing Phar

https://bugs.php.net/bug.php?id=69324 ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service buffer over-read and application crash via a crafted length value in...

Type confusion

IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling...

CVE-2015-1061

IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling...

Apple iOS IOSurface Type Obfuscation Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A type confusion vulnerability exists in IOSurface when Apple iOS handles serialized objects, which allows attackers to exploit the vulnerability to execute arbitrary code with system privileges...

PT-2015-1002

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.2 Apple OS X versions through 10.10.2 Apple TV versions prior to 7.1 Description The issue allows a remote attacker to execute arbitrary code with elevated privileges using a malicious application that exploits ty...

PT-2015-1021

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.38 PHP versions 5.5.x prior to 5.5.22 PHP versions 5.6.x prior to 5.6.6 Description The issue allows remote attackers to execute arbitrary code via crafted serialized input containing a 1 R or 2 r type specifier in a...

CVE-2015-0273

Multiple use-after-free vulnerabilities in ext/date/phpdate.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a 1 R or 2 r type specifier in a DateTimeZone data handled by the...

X2Engine < 4.2 Multiple Vulnerabilities

According to its version number, the X2Engine application installed on the remote web server is potentially affected by multiple vulnerabilities : - A PHP object injection vulnerability exists which can be used to carry out Server-Side Request Forgery SSRF attacks using specially crafted serializ...

CVE-2014-8165

scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object...

CVE-2014-8165

scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object...

CVE-2014-8165

scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object...

PHP Core Unserialize Key Name Code Execution (CVE-2015-0231)

A code execution vulnerability has been reported in PHP core. The vulnerability is due to a use after free error when handling serialized objects with identical number key names within the unserialize function. A remote attacker can exploit the vulnerability by sending crafted serialized data to ...

Updated owasp-esapi-java packages fix CVE-2013-5679

Updated owasp-esapi-java packages fix security vulnerability: The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API ESAPI for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier f...

Python-Pickle-Class-Constructor

Python is an open source, object oriented programming language. The Python Pickle module is provided to convert object variables into a serialized form "pickling", and later recover the data back into an object hierarchy "unpickling". A vulnerability has been reported in the Pickle implementation...

PHP Core unserialize process nested data Use After Free (CVE-2014-8142)

A code execution vulnerability has been reported in PHP core. The vulnerability is due to a use after free error when handling serialized objects with identical keys within the unserialize function. A remote attacker can exploit the vulnerability by sending crafted serialized data to a web...

Design/Logic Flaw

Use-after-free vulnerability in the processnesteddata function in ext/standard/varunserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate...

UBUNTU-CVE-2015-0231

Use-after-free vulnerability in the processnesteddata function in ext/standard/varunserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate...

[SECURITY] Fedora 20 Update: pkcs11-helper-1.11-3.fc20

pkcs11-helper is a library that simplifies the interaction with PKCS11 providers for end-user applications using a simple API and optional OpenSSL engine. The library allows using multiple PKCS11 providers at the same tim e, enumerating available token certificates, or selecting a certificate...

[SECURITY] Fedora 19 Update: pkcs11-helper-1.11-3.fc19

pkcs11-helper is a library that simplifies the interaction with PKCS11 providers for end-user applications using a simple API and optional OpenSSL engine. The library allows using multiple PKCS11 providers at the same tim e, enumerating available token certificates, or selecting a certificate...